CLSA-2026-1774570928 TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 5 CVEs. Fixed in 5.7.11-tuxcare.1...

CLSA-2026-1774570925 TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.12-tuxcare.2...

CLSA-2026-1774398071 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 19 org.springframework.security packages to address 1 CVE. Fixed in 6.1.6-tuxcare.2...

CLSA-2026-1774398070 TuxCare security update for org.springframework.security (3 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 3 CVEs. Fixed in 5.7.12-tuxcare.1...

CLSA-2026-1774225197 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 15 org.springframework.security packages to address 1 CVE. Fixed in 4.2.20.RELEASE-tuxcare.2...

CLSA-2026-1774398059 TuxCare security update for org.springframework.security (2 CVEs)

TuxCare rebuilt 21 org.springframework.security packages to address 2 CVEs. Fixed in 5.7.14-tuxcare.1...

CLSA-2026-1773015254 TuxCare security update for org.springframework.security (5 CVEs)

TuxCare rebuilt 15 org.springframework.security packages to address 5 CVEs. Fixed in 4.2.20.RELEASE-tuxcare.1...

CLSA-2026-1768522124 TuxCare security update for org.springframework.security:spring-security-oauth2-authorization-server (1 CVE)

TuxCare rebuilt org.springframework.security:spring-security-oauth2-authorization-server to address 1 CVE. Fixed in 1.1.4-tuxcare.1...

CLSA-2026-1768349319 TuxCare security update for org.springframework.security (4 CVEs)

TuxCare rebuilt 19 org.springframework.security packages to address 4 CVEs. Fixed in 6.1.6-tuxcare.1...

CLSA-2025-1742947247 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.8.16.tuxcare...

CLSA-2024-1727308812 TuxCare security update for org.springframework.security (1 CVE)

TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.11.tuxcare...

K000162757: Spring Security vulnerability CVE-2026-47838

Security Advisory Description SubjectDnX509PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an attacker impersonating another user. Affected...

ROOT-APP-MAVEN-CVE-2023-20862 CVE-2023-20862 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2023-20862 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-38827 CVE-2024-38827 in io.root.org.springframework.security:spring-security-core - Patched by Root

Root has patched CVE-2024-38827 in the io.root.org.springframework.security:spring-security-core package for Root:Maven. Multiple fixed versions available...

BASM (Broken Authentication & Session Management) org.springframework.security:spring-security-web Dependency in Crowd Data Center

This High severity BASM Broken Authentication & Session Management vulnerability was introduced in versions 6.0.0, 6.1.0, 6.2.0, 6.3.0, 7.0.0, 7.1.0, and 7.2.0 of Crowd Data Center. This BASM Broken Authentication & Session Management vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

CVE-2026-59328

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:15+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-59327

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:13+00:00| seen| https://cyber.gc.ca/en/alerts-advisories/spring-security-advisory-av26-759...

CVE-2026-8338

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...

CVE-2026-8338

The CVE describes a Spring Security authentication and authorization bypass in Coverity Connect versions 2023.6.0–2026.3.0. An unauthenticated attacker can send a specially crafted HTTP request to bypass authentication/authorization on certain API endpoints and access data within Coverity. CVSS 4...

EUVD-2026-50413

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoint...